docx-creator
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation and scripts guide the user through executing shell commands for building the project (
dotnet run), performing headless document conversion (soffice), and generating images for verification (pdftoppm). These commands are standard for the tool's stated purpose of document generation and verification. - [EXTERNAL_DOWNLOADS]: The skill references external dependencies through well-known services. It utilizes NuGet for C# libraries (
DocumentFormat.OpenXml,Markdig) and suggests using Homebrew (brew) to installpoppler. These are established and well-known package management services. - [INDIRECT_PROMPT_INJECTION]: The tool ingests markdown content which is then parsed to create document structures.
- Ingestion points: The C# program reads the content of a markdown file provided as a command-line argument (
scripts/Program.cs). - Boundary markers: The skill does not implement specific boundary markers or 'ignore' instructions for the markdown content, as it is treated as data for document formatting.
- Capability inventory: The skill has the capability to write to the local file system to create .docx files.
- Sanitization: Content is processed through the
Markdiglibrary, which parses the markdown into an abstract syntax tree (AST) before generating OpenXML elements.
Audit Metadata